Lenovo

About the job

Join our cybersecurity team as an Application Security Engineer and play a key role in promoting secure development practices for our clients. In this position, you will assess and enhance application security, work closely with application teams to create secure architectures, and offer expert security advice.

The Job

• Application Security Review - Perform thorough evaluations of applications to uncover vulnerabilities and risks. Offer clients remediation recommendations based on risk analysis.
• Secure Application Architecture Design - Collaborate with architects and developers to embed security into application design, establish security controls and best practices for software development, and promote DevSecOps initiatives to ensure secure CI/CD implementations.
• Attack Surface Evaluation - Identify potential threats and attack vectors in applications and systems, utilize methodologies such as STRIDE, DREAD, and PASTA for risk assessment, and collaborate with application teams to mitigate threats early in SDLC.
• Application Security Policy Development - Develop application security policies, standards, guidelines and practices, and provide security recommendations for application teams.
• Security Training - Conduct security awareness workshops to promote defense in depth for clients.
• Security Research - Investigate emerging threats, vulnerabilities, and security trends, spearhead or support security initiatives and tool integrations, evaluate new technologies for security risks, monitor and analyze key security metrics to gauge effectiveness, and enhance security reporting processes for improved risk visibility.

The Person

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Software Engineering, or related fields.
• 2+ years of hands-on experience (preferably in consulting experience) in application security, penetration testing, and DevSecOps.
• Proven project experience in vulnerability management, including scanning, manual testing, and remediation planning for clients in FSI, telecom, or critical infrastructure.
• Experience in utilizing security tooling: Kali Linux, Nessus, Burp Suite, GitLab CI/CD, OWASP ZAP, Azure, and etc.
• Familiar with security frameworks and guidelines such as OWASP, CIS, and ISO 27001.
• A holder of one of the following certifications: CISSP, CSSLP, Certified DevSecOps Professional (CDP), and CISP is a plus.
• Strong communication skills to collaborate with cross-functional teams.